From e159073da592324d60aefc3226560b8a954e81bf Mon Sep 17 00:00:00 2001 From: Ben Noordhuis Date: Sat, 9 Nov 2013 23:31:54 +0100 Subject: [PATCH] tools: customize mk-ca-bundle.pl Remove unneeded functionality and tweak the generated output so we can #include it in C++ source code. --- tools/mk-ca-bundle.pl | 100 +++++++++++++----------------------------- 1 file changed, 30 insertions(+), 70 deletions(-) diff --git a/tools/mk-ca-bundle.pl b/tools/mk-ca-bundle.pl index 1a9c859857a..3dd52f573dc 100755 --- a/tools/mk-ca-bundle.pl +++ b/tools/mk-ca-bundle.pl @@ -30,11 +30,11 @@ # dependency is the OpenSSL commandline tool for optional text listing. # Hacked by Guenter Knauf. # +use File::Basename 'dirname'; use Getopt::Std; use MIME::Base64; -use LWP::UserAgent; use strict; -use vars qw($opt_b $opt_f $opt_h $opt_i $opt_l $opt_n $opt_q $opt_t $opt_u $opt_v $opt_w); +use vars qw($opt_h $opt_i $opt_l $opt_q $opt_t $opt_v $opt_w); my $url = 'http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1'; # If the OpenSSL commandline is not in search path you can configure it here! @@ -42,7 +42,7 @@ my $openssl = 'openssl'; my $version = '1.19'; -$opt_w = 76; # default base64 encoded lines length +$opt_w = 72; # default base64 encoded lines length $0 =~ s@.*(/|\\)@@; $Getopt::Std::STANDARD_HELP_VERSION = 1; @@ -55,21 +55,15 @@ if ($opt_i) { print "Operating System Name : $^O\n"; print "Getopt::Std.pm Version : ${Getopt::Std::VERSION}\n"; print "MIME::Base64.pm Version : ${MIME::Base64::VERSION}\n"; - print "LWP::UserAgent.pm Version : ${LWP::UserAgent::VERSION}\n"; - print "LWP.pm Version : ${LWP::VERSION}\n"; print ("=" x 78 . "\n"); } sub HELP_MESSAGE() { - print "Usage:\t${0} [-b] [-f] [-i] [-l] [-n] [-q] [-t] [-u] [-v] [-w] []\n"; - print "\t-b\tbackup an existing version of ca-bundle.crt\n"; - print "\t-f\tforce rebuild even if certdata.txt is current\n"; + print "Usage:\t${0} [-i] [-l] [-q] [-t] [-v] [-w] []\n"; print "\t-i\tprint version info about used modules\n"; print "\t-l\tprint license info about certdata.txt\n"; - print "\t-n\tno download of certdata.txt (to use existing)\n"; print "\t-q\tbe really quiet (no progress output at all)\n"; print "\t-t\tinclude plain text listing of certificates\n"; - print "\t-u\tunlink (remove) certdata.txt after processing\n"; print "\t-v\tbe verbose and print out processed CAs\n"; print "\t-w \twrap base64 output lines after chars (default: ${opt_w})\n"; exit; @@ -81,56 +75,36 @@ sub VERSION_MESSAGE() { HELP_MESSAGE() if ($opt_h); -my $crt = $ARGV[0] || 'ca-bundle.crt'; -(my $txt = $url) =~ s@(.*/|\?.*)@@g; +my $crt = $ARGV[0] || dirname(__FILE__) . '/../src/node_root_certs.h'; +my $txt = dirname(__FILE__) . '/certdata.txt'; my $stdout = $crt eq '-'; my $resp; my $fetched; -unless ($opt_n and -e $txt) { - print STDERR "Downloading '$txt' ...\n" if (!$opt_q); - my $ua = new LWP::UserAgent(agent => "$0/$version"); - $ua->env_proxy(); - $resp = $ua->mirror($url, $txt); - if ($resp && $resp->code eq '304') { - print STDERR "Not modified\n" unless $opt_q; - exit 0 if -e $crt && !$opt_f; - } else { - $fetched = 1; - } - if( !$resp || $resp->code !~ /^(?:200|304)$/ ) { - print STDERR "Unable to download latest data: " - . ($resp? $resp->code . ' - ' . $resp->message : "LWP failed") . "\n" - unless $opt_q; - exit 1 if -e $crt || ! -r $txt; - } -} - my $currentdate = scalar gmtime($fetched ? $resp->last_modified : (stat($txt))[9]); my $format = $opt_t ? "plain text and " : ""; if( $stdout ) { open(CRT, '> -') or die "Couldn't open STDOUT: $!\n"; } else { - open(CRT,">$crt.~") or die "Couldn't open $crt.~: $!\n"; + open(CRT,">$crt") or die "Couldn't open $crt: $!\n"; } print CRT <) { next if /^#|^\s*$/; chomp; if (/^CVS_ID\s+\"(.*)\"/) { - print CRT "# $1\n"; + print CRT "/* $1 */\n"; } # this is a match for the start of a certificate @@ -192,25 +166,24 @@ while () { $skipnum ++; } else { my $encoded = MIME::Base64::encode_base64($data, ''); - $encoded =~ s/(.{1,${opt_w}})/$1\n/g; - my $pem = "-----BEGIN CERTIFICATE-----\n" + $encoded =~ s/(.{1,${opt_w}})/"$1\\n"\n/g; + my $pem = "\"-----BEGIN CERTIFICATE-----\\n\"\n" . $encoded - . "-----END CERTIFICATE-----\n"; - print CRT "\n$caname\n"; - print CRT ("=" x length($caname) . "\n"); + . "\"-----END CERTIFICATE-----\\n\",\n"; + print CRT "\n/* $caname */\n"; if (!$opt_t) { print CRT $pem; } else { my $pipe = "|$openssl x509 -md5 -fingerprint -text -inform PEM"; if (!$stdout) { - $pipe .= " >> $crt.~"; - close(CRT) or die "Couldn't close $crt.~: $!"; + $pipe .= " >> $crt"; + close(CRT) or die "Couldn't close $crt: $!"; } open(TMP, $pipe) or die "Couldn't open openssl pipe: $!"; print TMP $pem; close(TMP) or die "Couldn't close openssl pipe: $!"; if (!$stdout) { - open(CRT, ">>$crt.~") or die "Couldn't open $crt.~: $!"; + open(CRT, ">>$crt") or die "Couldn't open $crt: $!"; } } print STDERR "Parsing: $caname\n" if ($opt_v); @@ -220,20 +193,7 @@ while () { } } close(TXT) or die "Couldn't close $txt: $!\n"; -close(CRT) or die "Couldn't close $crt.~: $!\n"; -unless( $stdout ) { - if ($opt_b && -e $crt) { - my $bk = 1; - while (-e "$crt.~${bk}~") { - $bk++; - } - rename $crt, "$crt.~${bk}~" or die "Failed to create backup $crt.~$bk}~: $!\n"; - } elsif( -e $crt ) { - unlink( $crt ) or die "Failed to remove $crt: $!\n"; - } - rename "$crt.~", $crt or die "Failed to rename $crt.~ to $crt: $!\n"; -} -unlink $txt if ($opt_u); +close(CRT) or die "Couldn't close $crt: $!\n"; print STDERR "Done ($certnum CA certs processed, $skipnum untrusted skipped).\n" if (!$opt_q); exit;